MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20dba69956576e1be144cdebbfba349c1bb70eed69be10061426b6aedb63185d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20dba69956576e1be144cdebbfba349c1bb70eed69be10061426b6aedb63185d
SHA3-384 hash: 83bcf34f655767863114a1ec97879b95ee82a3ed6e889ead1bf59f70dd501bfbff9a6629c1fc1c5320c774814596e11c
SHA1 hash: 8b03fa2cfeb46a251d711b77a308edfca7ded294
MD5 hash: acc52e0779066b81ab8d1da42af619d3
humanhash: pizza-cup-missouri-sweet
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-09-01 03:18:29 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:b8vCB+25j6es8Ri9FYpMSUpi+20qUpi+20YQX:b8l25JEd2QX
TLSH T1BCC28C966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
45
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a96443328779b7e70db0f85/reports/a3d9788a-6b22-4cc4-b790-416ad7e256af/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/68f7f53b-bbaa-430b-999c-cd0732e3cb3c
Behavior Graph:
Download SVG
%3 guuid=9eea0c3a-1a00-0000-1dfc-aff200090000 pid=2304 /usr/bin/sudo guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308 /tmp/sample.bin guuid=9eea0c3a-1a00-0000-1dfc-aff200090000 pid=2304->guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308 execve guuid=d232193c-1a00-0000-1dfc-aff206090000 pid=2310 /usr/bin/bash guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=d232193c-1a00-0000-1dfc-aff206090000 pid=2310 clone guuid=6632203c-1a00-0000-1dfc-aff207090000 pid=2311 /usr/bin/base64 guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=6632203c-1a00-0000-1dfc-aff207090000 pid=2311 execve guuid=44de253c-1a00-0000-1dfc-aff208090000 pid=2312 /usr/bin/bash guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=44de253c-1a00-0000-1dfc-aff208090000 pid=2312 clone guuid=69eed23c-1a00-0000-1dfc-aff20a090000 pid=2314 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=69eed23c-1a00-0000-1dfc-aff20a090000 pid=2314 execve guuid=4c22553d-1a00-0000-1dfc-aff20b090000 pid=2315 /usr/bin/mkdir guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=4c22553d-1a00-0000-1dfc-aff20b090000 pid=2315 execve guuid=9444f33d-1a00-0000-1dfc-aff20c090000 pid=2316 /usr/bin/mkdir guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=9444f33d-1a00-0000-1dfc-aff20c090000 pid=2316 execve guuid=d301553e-1a00-0000-1dfc-aff20d090000 pid=2317 /usr/bin/mkdir guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=d301553e-1a00-0000-1dfc-aff20d090000 pid=2317 execve guuid=2d50c23e-1a00-0000-1dfc-aff210090000 pid=2320 /usr/bin/mkdir guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=2d50c23e-1a00-0000-1dfc-aff210090000 pid=2320 execve guuid=eba31b3f-1a00-0000-1dfc-aff212090000 pid=2322 /usr/bin/mkdir guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=eba31b3f-1a00-0000-1dfc-aff212090000 pid=2322 execve guuid=b048753f-1a00-0000-1dfc-aff214090000 pid=2324 /usr/bin/mkdir guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=b048753f-1a00-0000-1dfc-aff214090000 pid=2324 execve guuid=6c4ec33f-1a00-0000-1dfc-aff217090000 pid=2327 /usr/bin/mkdir guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=6c4ec33f-1a00-0000-1dfc-aff217090000 pid=2327 execve guuid=31ea2140-1a00-0000-1dfc-aff219090000 pid=2329 /usr/bin/mkdir guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=31ea2140-1a00-0000-1dfc-aff219090000 pid=2329 execve guuid=998e7d40-1a00-0000-1dfc-aff21b090000 pid=2331 /usr/bin/mkdir guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=998e7d40-1a00-0000-1dfc-aff21b090000 pid=2331 execve guuid=5407eb40-1a00-0000-1dfc-aff21d090000 pid=2333 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=5407eb40-1a00-0000-1dfc-aff21d090000 pid=2333 execve guuid=8b3c5f41-1a00-0000-1dfc-aff220090000 pid=2336 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=8b3c5f41-1a00-0000-1dfc-aff220090000 pid=2336 execve guuid=e28acf41-1a00-0000-1dfc-aff222090000 pid=2338 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=e28acf41-1a00-0000-1dfc-aff222090000 pid=2338 execve guuid=53095642-1a00-0000-1dfc-aff224090000 pid=2340 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=53095642-1a00-0000-1dfc-aff224090000 pid=2340 execve guuid=0b17ff42-1a00-0000-1dfc-aff227090000 pid=2343 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=0b17ff42-1a00-0000-1dfc-aff227090000 pid=2343 execve guuid=1a489643-1a00-0000-1dfc-aff229090000 pid=2345 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=1a489643-1a00-0000-1dfc-aff229090000 pid=2345 execve guuid=06e52844-1a00-0000-1dfc-aff22c090000 pid=2348 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=06e52844-1a00-0000-1dfc-aff22c090000 pid=2348 execve guuid=9d88c944-1a00-0000-1dfc-aff22d090000 pid=2349 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=9d88c944-1a00-0000-1dfc-aff22d090000 pid=2349 execve guuid=c1c86e45-1a00-0000-1dfc-aff22f090000 pid=2351 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=c1c86e45-1a00-0000-1dfc-aff22f090000 pid=2351 execve guuid=20904246-1a00-0000-1dfc-aff230090000 pid=2352 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=20904246-1a00-0000-1dfc-aff230090000 pid=2352 execve guuid=1131c646-1a00-0000-1dfc-aff232090000 pid=2354 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=1131c646-1a00-0000-1dfc-aff232090000 pid=2354 execve guuid=16a58647-1a00-0000-1dfc-aff234090000 pid=2356 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=16a58647-1a00-0000-1dfc-aff234090000 pid=2356 execve guuid=2fd20148-1a00-0000-1dfc-aff235090000 pid=2357 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=2fd20148-1a00-0000-1dfc-aff235090000 pid=2357 execve guuid=244a7a48-1a00-0000-1dfc-aff236090000 pid=2358 /usr/bin/cp guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=244a7a48-1a00-0000-1dfc-aff236090000 pid=2358 execve guuid=a989e748-1a00-0000-1dfc-aff238090000 pid=2360 /usr/bin/touch guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=a989e748-1a00-0000-1dfc-aff238090000 pid=2360 execve guuid=69e06549-1a00-0000-1dfc-aff23a090000 pid=2362 /usr/bin/chmod guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=69e06549-1a00-0000-1dfc-aff23a090000 pid=2362 execve guuid=ffd0df49-1a00-0000-1dfc-aff23b090000 pid=2363 /usr/bin/chmod guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=ffd0df49-1a00-0000-1dfc-aff23b090000 pid=2363 execve guuid=ac323d4a-1a00-0000-1dfc-aff23d090000 pid=2365 /usr/bin/chattr guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=ac323d4a-1a00-0000-1dfc-aff23d090000 pid=2365 execve guuid=8c39b44a-1a00-0000-1dfc-aff240090000 pid=2368 /usr/bin/chattr guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=8c39b44a-1a00-0000-1dfc-aff240090000 pid=2368 execve guuid=3b8e024b-1a00-0000-1dfc-aff242090000 pid=2370 /usr/bin/chattr guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=3b8e024b-1a00-0000-1dfc-aff242090000 pid=2370 execve guuid=086c514b-1a00-0000-1dfc-aff244090000 pid=2372 /usr/bin/chattr guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=086c514b-1a00-0000-1dfc-aff244090000 pid=2372 execve guuid=6b65b14b-1a00-0000-1dfc-aff246090000 pid=2374 /usr/bin/chattr guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=6b65b14b-1a00-0000-1dfc-aff246090000 pid=2374 execve guuid=63871b4c-1a00-0000-1dfc-aff247090000 pid=2375 /usr/bin/chattr guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=63871b4c-1a00-0000-1dfc-aff247090000 pid=2375 execve guuid=8261a74c-1a00-0000-1dfc-aff249090000 pid=2377 /usr/bin/chattr guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=8261a74c-1a00-0000-1dfc-aff249090000 pid=2377 execve guuid=d5dd2d4d-1a00-0000-1dfc-aff24a090000 pid=2378 /usr/bin/chattr guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=d5dd2d4d-1a00-0000-1dfc-aff24a090000 pid=2378 execve guuid=14d0be4d-1a00-0000-1dfc-aff24b090000 pid=2379 /usr/bin/bash guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=14d0be4d-1a00-0000-1dfc-aff24b090000 pid=2379 clone guuid=9ad7ca4d-1a00-0000-1dfc-aff24c090000 pid=2380 /usr/bin/bash guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=9ad7ca4d-1a00-0000-1dfc-aff24c090000 pid=2380 clone guuid=db7b1c4e-1a00-0000-1dfc-aff24d090000 pid=2381 /usr/bin/curl net send-data guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=db7b1c4e-1a00-0000-1dfc-aff24d090000 pid=2381 execve guuid=9873284e-1a00-0000-1dfc-aff24e090000 pid=2382 /usr/bin/dash guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=9873284e-1a00-0000-1dfc-aff24e090000 pid=2382 execve guuid=3d24565a-1a00-0000-1dfc-aff266090000 pid=2406 /usr/bin/bash guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=3d24565a-1a00-0000-1dfc-aff266090000 pid=2406 clone guuid=9a22615a-1a00-0000-1dfc-aff267090000 pid=2407 /usr/bin/base64 guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=9a22615a-1a00-0000-1dfc-aff267090000 pid=2407 execve guuid=5f2b695a-1a00-0000-1dfc-aff268090000 pid=2408 /usr/bin/tee write-file guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=5f2b695a-1a00-0000-1dfc-aff268090000 pid=2408 execve guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410 /usr/bin/bash guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410 execve guuid=d5b76263-1a00-0000-1dfc-aff28f090000 pid=2447 /usr/bin/bash guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=d5b76263-1a00-0000-1dfc-aff28f090000 pid=2447 execve guuid=1728da63-1a00-0000-1dfc-aff291090000 pid=2449 /usr/bin/rm delete-file guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=1728da63-1a00-0000-1dfc-aff291090000 pid=2449 execve guuid=5a933c64-1a00-0000-1dfc-aff294090000 pid=2452 /usr/bin/rm guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=5a933c64-1a00-0000-1dfc-aff294090000 pid=2452 execve guuid=076d9864-1a00-0000-1dfc-aff295090000 pid=2453 /usr/bin/curl net send-data guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=076d9864-1a00-0000-1dfc-aff295090000 pid=2453 execve guuid=4e039f64-1a00-0000-1dfc-aff296090000 pid=2454 /usr/bin/dash guuid=f338c13b-1a00-0000-1dfc-aff204090000 pid=2308->guuid=4e039f64-1a00-0000-1dfc-aff296090000 pid=2454 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=db7b1c4e-1a00-0000-1dfc-aff24d090000 pid=2381->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=7945e25b-1a00-0000-1dfc-aff26c090000 pid=2412 /usr/bin/bash guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=7945e25b-1a00-0000-1dfc-aff26c090000 pid=2412 clone guuid=7072ea5b-1a00-0000-1dfc-aff26d090000 pid=2413 /usr/bin/bash guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=7072ea5b-1a00-0000-1dfc-aff26d090000 pid=2413 clone guuid=9cf21f5c-1a00-0000-1dfc-aff26f090000 pid=2415 /usr/bin/ls guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=9cf21f5c-1a00-0000-1dfc-aff26f090000 pid=2415 execve guuid=8c28c85c-1a00-0000-1dfc-aff272090000 pid=2418 /usr/bin/cat guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=8c28c85c-1a00-0000-1dfc-aff272090000 pid=2418 execve guuid=e9db2e5d-1a00-0000-1dfc-aff275090000 pid=2421 /usr/bin/ls guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=e9db2e5d-1a00-0000-1dfc-aff275090000 pid=2421 execve guuid=0d42c75d-1a00-0000-1dfc-aff278090000 pid=2424 /usr/bin/mkdir guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=0d42c75d-1a00-0000-1dfc-aff278090000 pid=2424 execve guuid=6e3f435e-1a00-0000-1dfc-aff27b090000 pid=2427 /usr/bin/mv guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=6e3f435e-1a00-0000-1dfc-aff27b090000 pid=2427 execve guuid=b3fbde5e-1a00-0000-1dfc-aff27d090000 pid=2429 /usr/bin/bash guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=b3fbde5e-1a00-0000-1dfc-aff27d090000 pid=2429 clone guuid=0b40e95e-1a00-0000-1dfc-aff27e090000 pid=2430 /usr/bin/base64 write-file guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=0b40e95e-1a00-0000-1dfc-aff27e090000 pid=2430 execve guuid=f76e585f-1a00-0000-1dfc-aff27f090000 pid=2431 /usr/bin/rm delete-file guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=f76e585f-1a00-0000-1dfc-aff27f090000 pid=2431 execve guuid=3108b55f-1a00-0000-1dfc-aff281090000 pid=2433 /usr/bin/mv guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=3108b55f-1a00-0000-1dfc-aff281090000 pid=2433 execve guuid=32ff7d60-1a00-0000-1dfc-aff282090000 pid=2434 /usr/bin/ls guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=32ff7d60-1a00-0000-1dfc-aff282090000 pid=2434 execve guuid=5dc98161-1a00-0000-1dfc-aff283090000 pid=2435 /usr/bin/bash guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=5dc98161-1a00-0000-1dfc-aff283090000 pid=2435 clone guuid=29378c61-1a00-0000-1dfc-aff284090000 pid=2436 /usr/bin/base64 write-file guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=29378c61-1a00-0000-1dfc-aff284090000 pid=2436 execve guuid=c31f1862-1a00-0000-1dfc-aff287090000 pid=2439 /usr/bin/ls guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=c31f1862-1a00-0000-1dfc-aff287090000 pid=2439 execve guuid=223d8c62-1a00-0000-1dfc-aff28a090000 pid=2442 /usr/bin/cat guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=223d8c62-1a00-0000-1dfc-aff28a090000 pid=2442 execve guuid=7a59d162-1a00-0000-1dfc-aff28c090000 pid=2444 /usr/bin/ls guuid=113f875b-1a00-0000-1dfc-aff26a090000 pid=2410->guuid=7a59d162-1a00-0000-1dfc-aff28c090000 pid=2444 execve guuid=076d9864-1a00-0000-1dfc-aff295090000 pid=2453->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/20dba69956576e1be144cdebbfba349c1bb70eed69be10061426b6aedb63185d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/20dba69956576e1be144cdebbfba349c1bb70eed69be10061426b6aedb63185d/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=edn2ngkwk5xbxykezxv37orutqn3odxnng7babque23k5w3ddboq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260901-dvanbsgq9s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 20dba69956576e1be144cdebbfba349c1bb70eed69be10061426b6aedb63185d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments